skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-ntlm-relay-attacks

Detect NTLM relay attacks by analyzing Windows Event 4624 and SMB signing status.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#responder#Active Directory#NTLM relay#smb signing#windows event 4624
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-ntlm-relay-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-ntlm-relay-attacks
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-ntlm-relay-attacks
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-ntlm-relay-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

NTLM relay attacks let adversaries intercept and forward NTLM authentication to gain unauthorized access, and they are hard to spot in noisy Windows logs. This Skill gives SOC analysts a structured hunting procedure to surface relay activity before it becomes a breach.

Core Features & Use Cases

  • Event 4624 Analysis: Query Windows Security logon events for type 3 network logons using NTLMSSP, flagging WorkstationName-to-IP mismatches.
  • Relay Pattern Detection: Identify machine account relays, rapid multi-host authentication from single accounts, and suspicious named pipe access via Event 5145.
  • SMB Signing Audit: Check domain hosts for disabled SMB signing that enables relay attacks.
  • Use Case: During an incident investigation, run this hunt across domain controllers to find Responder/ntlmrelayx activity, then receive a JSON report mapping findings to MITRE ATT&CK T1557.001.

Quick Start

Hunt for NTLM relay attacks across our domain by analyzing Windows Event 4624 logs and auditing SMB signing status.

Frequently Asked Questions about hunting-for-ntlm-relay-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect NTLM relay attacks in Windows event logs?▼

Query Windows Security Event 4624 for logon type 3 with NTLMSSP authentication, then check whether the WorkstationName resolves to the source IpAddress. Mismatches, machine accounts authenticating from unexpected IPs, and rapid multi-host logons indicate relay activity.

What Windows event IDs indicate NTLM relay or coercion attacks?▼

Event 4624 with logon type 3 and NTLM authentication is the primary indicator. Event 5145 showing access to named pipes like spoolss, efsrpc, lsarpc, netlogon, or samr reveals coercion attempts such as PetitPotam or PrinterBug.

What are the limitations of IP-hostname mismatch detection for NTLM relay?▼

Same-subnet relays defeat the mismatch check when attacker and victim share a subnet or the attacker preserves WorkstationName. NAT and load balancers also cause legitimate mismatches, so whitelist known service accounts and source ranges to reduce false positives.

Does this hunt cover LDAP and HTTP relay paths like ESC8?▼

No, the SMB signing audit covers only SMB. LDAP and HTTP relay paths such as AD CS web enrollment (ESC8) and PetitPotam coercion require separate monitoring, including watching Event 4624 NTLMSSP logons targeting the CA enrollment host.

How do I validate that NTLM relay detection is working?▼

Run Responder and ntlmrelayx.py, or a coercer like PetitPotam.py, in a lab environment. Confirm that Event 4624 logon type 3 with NTLM authentication, WorkstationName-IP mismatches, and Event 5145 pipe access all appear and trigger alerts.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

detecting-kerberoasting-attacks

Detect Kerberoasting indicators from Windows Event 4769 and 4624 logs.

Community
Advanced
okayusokayus

sandboxed-agent-git-relay

Publish sandboxed agent commits to GitHub via a host-side relay.

Community
Advanced
wgpsecwgpsec
1.7k

responder-poison

Captures NTLMv2 hashes via LLMNR/NBT-NS/mDNS poisoning with Responder in Windows domain networks.

Official
Intermediate
starwreckntxstarwreckntx

Intrusion Detection Agent

Detect intrusions by correlating alerts and analyzing attack patterns in networked environments.

Community
Basic